I'm currently setting up an installation of mediawiki on arch linux using nginx and mariadb as a database. Since it will be a private wiki I would like to encrypt the database files using veracrypt.
So far I have done the following:
- Straight forward installation of mediawiki
- Create a veracrypt container & mount it
- After stopping all the relevant services (nginx, php-fpm, mysqld) I moved all the database files (/var/lib/mysql/nameofthewikidb/) into the container, unmount the container
- Delete the contents of /var/lib/mysql/nameofthewikidb/ and mount the container at /var/lib/mysql/nameofthewikidb/
- Start the mediawiki installation (nginx, php-fpm, mysqld)
So far everything looks good and I was able to use the wiki (insert/edit articles). I am planning on writing a simple bash script to start/stop the wiki and mount/unmount the containers
I will employ a similar approach for the mediawiki installation in /usr/share/webapps/mediawiki/ since it will contain uploaded images etc.
My question(s):
- Can you spot any obvious flaw with my security concept so far?
- I think I will have to deal with the log files (mysql-bin.XXXXXX) as well. Is it safe to delete them or should I put them in a container as well?
Thanks in advance!